Bugzilla will be upgraded to version 5.0. The upgrade date is tentatively scheduled for 2 December 2018, pending final testing and feedback.
First Last Prev Next    This bug is not in your last search results.
Bug 1508486 - AVC denial about chronyc, chronyd_t, and chronyc_exec_t
AVC denial about chronyc, chronyd_t, and chronyc_exec_t
Status: CLOSED ERRATA
Product: Red Hat Enterprise Linux 7
Classification: Red Hat
Component: selinux-policy (Show other bugs)
7.5
All Linux
high Severity high
: rc
: ---
Assigned To: Lukas Vrabec
Milos Malik
: Regression
Depends On:
Blocks: 1477564
  Show dependency tree / graph
 
Reported: 2017-11-01 10:18 EDT by Jan Pazdziora
Modified: 2018-04-10 08:46 EDT (History)
9 users (show)

See Also:
Fixed In Version: selinux-policy-3.13.1-176.el7
Doc Type: If docs needed, set a value
Doc Text:
Story Points: ---
Clone Of:
Environment:
Last Closed: 2018-04-10 08:46:03 EDT
Type: Bug
Regression: ---
Mount Type: ---
Documentation: ---
CRM:
Verified Versions:
Category: ---
oVirt Team: ---
RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: ---

Attachments (Terms of Use)
Add an attachment (proposed patch, testcase, etc.)


External Trackers
Tracker ID Priority Status Summary Last Updated
Red Hat Product Errata RHBA-2018:0763 None None None 2018-04-10 08:46 EDT

  None (edit)
Description Jan Pazdziora 2017-11-01 10:18:13 EDT 
Description of problem:

When docker is started, it likely does something to chronyd which leads to chrony-helper invocation. That produces AVC denials.

Version-Release number of selected component (if applicable):

docker-1.12.6-61.git85d7426.el7.x86_64
chrony-3.2-1.el7.x86_64
selinux-policy-3.13.1-175.el7.noarch

How reproducible:

Deterministic.

Steps to Reproduce:
1. Install docker from Extras.
2. systemctl start docker
3. Check audit.log

Actual results:

type=AVC msg=audit(1509545489.744:85): avc:  denied  { execute_no_trans } for  pid=13062 comm="chrony-helper" path="/usr/bin/chronyc" dev="dm-0" ino=283534 scontext=system_u:system_r:chronyd_t:s0 tcontext=system_u:object_r:chronyc_exec_t:s0 tclass=file

Expected results:

No AVC denial.

Additional info:
Comment 3 Jan Pazdziora 2017-11-01 10:18:38 EDT 
I believe this is RHEL version of Fedora bug 1507478.
Comment 5 Jan Pazdziora 2017-11-01 10:19:42 EDT 
On RHEL 7.5, I see

# ls -laZ /usr/bin/chronyc
-rwxr-xr-x. root root system_u:object_r:chronyc_exec_t:s0 /usr/bin/chronyc

On RHEL 7.4 with selinux-policy-3.13.1-166.el7_4.5.noarch, there is

# ls -laZ /usr/bin/chronyc
-rwxr-xr-x. root root system_u:object_r:bin_t:s0       /usr/bin/chronyc
Comment 6 Lukas Vrabec 2017-11-01 10:22:55 EDT 
Jan, 

You're right. This should be fixed in RHEL-7.5. Adding devel_ack+. 

Thanks,
Lukas.
Comment 15 errata-xmlrpc 2018-04-10 08:46:03 EDT 
Since the problem described in this bug report should be
resolved in a recent advisory, it has been closed with a
resolution of ERRATA.

For information on the advisory, and where to find the updated
files, follow the link below.

If the solution does not work for you, open a new bug report.

https://access.redhat.com/errata/RHBA-2018:0763
Note You need to log in before you can comment on or make changes to this bug.
First Last Prev Next    This bug is not in your last search results.